Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 19 Aug 2022 17:20:36 -0700
From:   Ira Weiny <ira.weiny@intel.com>
To:     Davidlohr Bueso <dave@stgolabs.net>
CC:     <linux-arch@vger.kernel.org>, <dan.j.williams@intel.com>,
        <peterz@infradead.org>, <mark.rutland@arm.com>,
        <dave.jiang@intel.com>, <Jonathan.Cameron@huawei.com>,
        <a.manzanares@samsung.com>, <bwidawsk@kernel.org>,
        <alison.schofield@intel.com>, <linux-cxl@vger.kernel.org>,
        <nvdimm@lists.linux.dev>, <x86@kernel.org>,
        <linux-arm-kernel@lists.infradead.org>,
        <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH v2] arch/cacheflush: Introduce flush_all_caches()
Message-ID: <YwAo1Ec13hjiBOat@iweiny-desk3>
References: <20220819171024.1766857-1-dave@stgolabs.net>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <20220819171024.1766857-1-dave@stgolabs.net>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?30d0/F33/EI060Ajh8CVZ54ngsmKjzoLd94XOufO2+OTsbTzIOe+lHGDM09j?=
 =?us-ascii?Q?0d0TDy/94jIHnWEgwa1iSCqwZzT2ODHpDETcYuH0L/qy1x0Wn/BzOvFDJJD8?=
 =?us-ascii?Q?5K+LZdXgjX/j96UEW1rSyM0QhD1pI5cNMzreu44tf9NjzQ+hf4BHhj8SZM2v?=
 =?us-ascii?Q?EEzTVLAQkZkM9x/iN+tMBbv08e+vBEKskTJRtzss35yx2Fj9PKicpNZ/uot2?=
 =?us-ascii?Q?1bYAChidhkp25uDbNzMh2vabG+zYhiynYzNV4oXxzpYhMKGnXLw+tIdwRYLd?=
 =?us-ascii?Q?paT8EHPKzNMJyn0ZuQBxrI5yjSFPad+viHlyCvied23tgH6DtO35tblpmFYQ?=
 =?us-ascii?Q?n7ZIhIGuAb8mgmEL1RvcQqNMPMbjsmiOHsVUdI0P88k0OqzTP5Tm++/Pzyph?=
 =?us-ascii?Q?Bs6asYOfFZhBaDCBzJ3J/gFrGX4bCcL4uQGeHV+d7mWhUcduUe7kEJqAf7aw?=
 =?us-ascii?Q?wiBZsfJ7QdXyr+t8ZFVmjnIAY8oZ+KElg3LcGmnZ6Y9OQs8guxAEUJ3kGXy5?=
 =?us-ascii?Q?DoXsjrjK29mtTp+yo2dllCOjG9G6wknB7SHiPnXXqo79FuhnjoTr7rToP1l9?=
 =?us-ascii?Q?xu9FZe3tHrskigAwPBRjgByhG2VczR4MgrXmYHzgpRP/pri1tlES2pylAzTS?=
 =?us-ascii?Q?iLlq9SeWsLCkiuPXHezTWlN4qe7zS3q8Wll6I2GBEhzvyIxIV27/HcN18nuL?=
 =?us-ascii?Q?ReNlctoRD+1qhwUfuaSmFbxqAfNZ5k55JBQCC+SJE35LXMxLEpdt+8dbE1qa?=
 =?us-ascii?Q?oV6RN/5yvR8PlVQz1xiDv+cGlrXAtZzPzoHoaT48F/DPqCYHaaraZj5d66YE?=
 =?us-ascii?Q?eKT4puCwMamABLNL8lTmA1oDB+LZ2bAdjBrg5Q9U9yRTSdfNq/VHDbiymjzG?=
 =?us-ascii?Q?ZsEl2qmBFVp6IwkhvKGQ35bXfLbpIUVAJDyaZzzQUZUunFCWN4e6cyKz9y1r?=
 =?us-ascii?Q?GPxO+QmS2bs8Yn1UFKx/DWfMrDBJJWwo0NCRl+ZaYEcJ9xtnmbQHQGqkLnMj?=
 =?us-ascii?Q?ubBz/RuE9Jm26RUHJRGBSgM5R2ovWC6mC95Wc74X2ABXNpiYgVq7NjXEp1Tn?=
 =?us-ascii?Q?lA9cDS249TOMHoLkIM5TTmlkpP5rmMeFf+qCyZon8JbatFANssLQWVun/qm6?=
 =?us-ascii?Q?2b7L2B4yAPZpSdfBZEDE4fbfUUcVwR0tDZ0uB/0Zb2c7g2gBHGcNVKvi+TWu?=
 =?us-ascii?Q?SIz0gvdEF8dh8JOsGQ0u2IHv6rMgnbrgc0WLjQVdsqxc/hpN3GJcpuFblSWp?=
 =?us-ascii?Q?xUeRXixvBtItTxdp+HKNQao/QdrT8Db5HUZ8ZcJOglVjbxtT97fiWIXBw+62?=
 =?us-ascii?Q?IaAB03P5r7bOIhfoZFRnleQoiuSU1rga1nUxt+WFz5hu82SYQnCQRa9Xfsyu?=
 =?us-ascii?Q?Os1GEL5Qo0A77QwddLxs5PyppxXE+v50Hf9+1IWvg7Vc+X3StdfoOklkmhaH?=
 =?us-ascii?Q?UfqGhiI0gnNsVL6qff6C0HmYWSfPjYGmfWABhmYlNLcWkh1unVd5Xp6l2vYB?=
 =?us-ascii?Q?3dL5NrUIVnxWLGBH1X4XVYayHjkUIg6n87/HM5hoXfLR9n++m9n5QYDYDO6F?=
 =?us-ascii?Q?Ceqan+S3zvdXr2RHu7aud18aFjeU0DuNIq0sx0wJ?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 3d1a30ed-6e64-4e91-0279-08da8241d0a6
X-MS-Exchange-CrossTenant-AuthSource: SA1PR11MB6733.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Aug 2022 00:20:41.2309
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: H1qgSnbd/jSfOIBSnTmNM446d6rHUjkMX/3/GqYYAyvvqyzaU5qREV8X6ftj1FcpkwRVJsd8Qn4B4VOV6caXVQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR11MB3571
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,
        RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, Aug 19, 2022 at 10:10:24AM -0700, Davidlohr Bueso wrote:
> With CXL security features, global CPU cache flushing nvdimm requirements
> are no longer specific to that subsystem, even beyond the scope of
> security_ops. CXL will need such semantics for features not necessarily
> limited to persistent memory.
> 
> The functionality this is enabling is to be able to instantaneously
> secure erase potentially terabytes of memory at once and the kernel
> needs to be sure that none of the data from before the secure is still
> present in the cache. It is also used when unlocking a memory device
> where speculative reads and firmware accesses could have cached poison
> from before the device was unlocked.
> 
> This capability is typically only used once per-boot (for unlock), or
> once per bare metal provisioning event (secure erase), like when handing
> off the system to another tenant or decomissioning a device. That small
> scope plus the fact that none of this is available to a VM limits the
> potential damage.
> 
> While the scope of this is for physical address space, add a new
> flush_all_caches() in cacheflush headers such that each architecture
> can define it, when capable. For x86 just use the wbinvd hammer and
> prevent any other arch from being capable.
> 
> Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
> ---
> 
> Changes from v1 (https://lore.kernel.org/all/20220815160706.tqd42dv24tgb7x7y@offworld/):
> - Added comments and improved changelog to reflect this is
>   routine should be avoided and not considered a general API (Peter, Dan).
> 
>  arch/x86/include/asm/cacheflush.h |  4 +++
>  drivers/acpi/nfit/intel.c         | 41 ++++++++++++++-----------------
>  include/asm-generic/cacheflush.h  | 31 +++++++++++++++++++++++
>  3 files changed, 53 insertions(+), 23 deletions(-)
> 
> diff --git a/arch/x86/include/asm/cacheflush.h b/arch/x86/include/asm/cacheflush.h
> index b192d917a6d0..ac4d4fd4e508 100644
> --- a/arch/x86/include/asm/cacheflush.h
> +++ b/arch/x86/include/asm/cacheflush.h
> @@ -10,4 +10,8 @@
>  
>  void clflush_cache_range(void *addr, unsigned int size);
>  
> +/* see comments in the stub version */
> +#define flush_all_caches() \
> +	do { wbinvd_on_all_cpus(); } while(0)
> +
>  #endif /* _ASM_X86_CACHEFLUSH_H */
> diff --git a/drivers/acpi/nfit/intel.c b/drivers/acpi/nfit/intel.c
> index 8dd792a55730..f2f6c31e6ab7 100644
> --- a/drivers/acpi/nfit/intel.c
> +++ b/drivers/acpi/nfit/intel.c
> @@ -4,6 +4,7 @@
>  #include <linux/ndctl.h>
>  #include <linux/acpi.h>
>  #include <asm/smp.h>
> +#include <linux/cacheflush.h>
>  #include "intel.h"
>  #include "nfit.h"
>  
> @@ -190,8 +191,6 @@ static int intel_security_change_key(struct nvdimm *nvdimm,
>  	}
>  }
>  
> -static void nvdimm_invalidate_cache(void);
> -
>  static int __maybe_unused intel_security_unlock(struct nvdimm *nvdimm,
>  		const struct nvdimm_key_data *key_data)
>  {
> @@ -210,6 +209,9 @@ static int __maybe_unused intel_security_unlock(struct nvdimm *nvdimm,
>  	};
>  	int rc;
>  
> +	if (!flush_all_caches_capable())
> +		return -EINVAL;
> +
>  	if (!test_bit(NVDIMM_INTEL_UNLOCK_UNIT, &nfit_mem->dsm_mask))
>  		return -ENOTTY;
>  
> @@ -228,7 +230,7 @@ static int __maybe_unused intel_security_unlock(struct nvdimm *nvdimm,
>  	}
>  
>  	/* DIMM unlocked, invalidate all CPU caches before we read it */
> -	nvdimm_invalidate_cache();
> +	flush_all_caches();
>  
>  	return 0;
>  }
> @@ -294,11 +296,14 @@ static int __maybe_unused intel_security_erase(struct nvdimm *nvdimm,
>  		},
>  	};
>  
> +	if (!flush_all_caches_capable())
> +		return -EINVAL;
> +
>  	if (!test_bit(cmd, &nfit_mem->dsm_mask))
>  		return -ENOTTY;
>  
>  	/* flush all cache before we erase DIMM */
> -	nvdimm_invalidate_cache();
> +	flush_all_caches();
>  	memcpy(nd_cmd.cmd.passphrase, key->data,
>  			sizeof(nd_cmd.cmd.passphrase));
>  	rc = nvdimm_ctl(nvdimm, ND_CMD_CALL, &nd_cmd, sizeof(nd_cmd), NULL);
> @@ -318,7 +323,7 @@ static int __maybe_unused intel_security_erase(struct nvdimm *nvdimm,
>  	}
>  
>  	/* DIMM erased, invalidate all CPU caches before we read it */
> -	nvdimm_invalidate_cache();
> +	flush_all_caches();
>  	return 0;
>  }
>  
> @@ -338,6 +343,9 @@ static int __maybe_unused intel_security_query_overwrite(struct nvdimm *nvdimm)
>  		},
>  	};
>  
> +	if (!flush_all_caches_capable())
> +		return -EINVAL;
> +
>  	if (!test_bit(NVDIMM_INTEL_QUERY_OVERWRITE, &nfit_mem->dsm_mask))
>  		return -ENOTTY;
>  
> @@ -355,7 +363,7 @@ static int __maybe_unused intel_security_query_overwrite(struct nvdimm *nvdimm)
>  	}
>  
>  	/* flush all cache before we make the nvdimms available */
> -	nvdimm_invalidate_cache();
> +	flush_all_caches();
>  	return 0;
>  }
>  
> @@ -377,11 +385,14 @@ static int __maybe_unused intel_security_overwrite(struct nvdimm *nvdimm,
>  		},
>  	};
>  
> +	if (!flush_all_caches_capable())
> +		return -EINVAL;
> +
>  	if (!test_bit(NVDIMM_INTEL_OVERWRITE, &nfit_mem->dsm_mask))
>  		return -ENOTTY;
>  
>  	/* flush all cache before we erase DIMM */
> -	nvdimm_invalidate_cache();
> +	flush_all_caches();
>  	memcpy(nd_cmd.cmd.passphrase, nkey->data,
>  			sizeof(nd_cmd.cmd.passphrase));
>  	rc = nvdimm_ctl(nvdimm, ND_CMD_CALL, &nd_cmd, sizeof(nd_cmd), NULL);
> @@ -401,22 +412,6 @@ static int __maybe_unused intel_security_overwrite(struct nvdimm *nvdimm,
>  	}
>  }
>  
> -/*
> - * TODO: define a cross arch wbinvd equivalent when/if
> - * NVDIMM_FAMILY_INTEL command support arrives on another arch.
> - */
> -#ifdef CONFIG_X86
> -static void nvdimm_invalidate_cache(void)
> -{
> -	wbinvd_on_all_cpus();
> -}
> -#else
> -static void nvdimm_invalidate_cache(void)
> -{
> -	WARN_ON_ONCE("cache invalidation required after unlock\n");
> -}
> -#endif
> -
>  static const struct nvdimm_security_ops __intel_security_ops = {
>  	.get_flags = intel_security_flags,
>  	.freeze = intel_security_freeze,
> diff --git a/include/asm-generic/cacheflush.h b/include/asm-generic/cacheflush.h
> index 4f07afacbc23..89f310f92498 100644
> --- a/include/asm-generic/cacheflush.h
> +++ b/include/asm-generic/cacheflush.h
> @@ -115,4 +115,35 @@ static inline void flush_cache_vunmap(unsigned long start, unsigned long end)
>  	memcpy(dst, src, len)
>  #endif
>  
> +/*
> + * Flush the entire caches across all CPUs, however:
> + *
> + *       YOU DO NOT WANT TO USE THIS FUNCTION.
> + *
> + * It is considered a big hammer and can affect overall
> + * system performance and increase latency/response times.
> + * As such it is not for general usage, but for specific use
> + * cases involving instantaneously invalidating wide swaths
> + * of memory on bare metal.
> +
> + * Unlike the APIs above, this function can be defined on
> + * architectures which have VIPT or PIPT caches, and thus is
> + * beyond the scope of virtual to physical mappings/page
> + * tables changing.
> + *
> + * The limitation here is that the architectures that make
> + * use of it must can actually comply with the semantics,

	"must can"?

Did you mean "must"?

> + * such as those which caches are in a consistent state. The
> + * caller can verify the situation early on.
> + */
> +#ifndef flush_all_caches
> +# define flush_all_caches_capable() false
> +static inline void flush_all_caches(void)
> +{
> +	WARN_ON_ONCE("cache invalidation required\n");
> +}

With the addition of flush_all_caches_capable() will flush_all_caches() ever be
called?

Ira

> +#else
> +# define flush_all_caches_capable() true
> +#endif
> +
>  #endif /* _ASM_GENERIC_CACHEFLUSH_H */
> -- 
> 2.37.2
>